Last updated: 2 September 2026
Privacy policy
This document describes what data this site collects, why, on what legal basis and for how long I keep it. Every section opens with a short summary naming the legal basis, the retention period and the recipient, and the exact wording of the rules stands underneath. There is no analytics, no tracking and no cookies of my own here.
Data controller
The controller of your personal data is me, Patryk Moga, running a sole proprietorship entered in the Polish business register (CEIDG), tax ID (NIP) 9970171965. In any matter concerning your data you write directly to me at kontakt@patrykmoga.dev or by post to Klatka 9a, 98-400 Klatka. I have not appointed a data protection officer, because the law does not require me to, so your request reaches the person who actually decides about this data.
Wherever this document says GDPR, it means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
The short version
This site runs no analytics, carries no advertising or tracking tools, and I build no profiles of visitors. The typefaces are served from my own server, so your browser never contacts Google or any external library along the way. The only data that reaches me is what you type into the contact form, plus the technical connection information without which the page could not be delivered at all.
Contact form
In the form you provide your name, e-mail address and message, and optionally the package, maintenance option and add-on you are interested in. That data reaches me by e-mail and serves one purpose only: answering your question and preparing a possible quote.
The legal basis is Article 6(1)(b) GDPR, that is taking steps at your request before entering into a contract, and for messages that do not concern working together, my legitimate interest in replying to correspondence addressed to me (Article 6(1)(f) GDPR). Ticking the box before sending confirms that you have read this policy; it is not a separate consent that you would later have to withdraw.
Inquiries that do not lead to a project are deleted twelve months after the last message. If we do sign a contract, I keep the correspondence and documents for its duration and then for the periods required by Polish tax and accounting law, and until claims become time-barred.
Protecting the form from bots
The form is protected by Cloudflare Turnstile, a mechanism that tells a human from a script without showing puzzles and without any accounts. Your browser loads a script from challenges.cloudflare.com and solves a technical test in the background, and in doing so Cloudflare receives your IP address along with information about your browser and device, needed to judge whether the traffic is automated. The result comes back to me as a single-use token, which my server verifies with Cloudflare, passing the sender's IP address during that verification. I also check a hidden form field and how long the form took to fill in, because scripts submit forms instantly.
The legal basis is my legitimate interest in protecting my inbox from spam and abuse (Article 6(1)(f) GDPR). Turnstile is not used for advertising or for tracking visitors across sites, and Cloudflare describes the details in its Turnstile Privacy Addendum.
Hosting and logs
The site runs on Cloudflare infrastructure, which in delivering it to your browser processes technical connection data: IP address, browser type, the address of the requested page and the time of the request. This serves to display the page and to protect it against overload and attacks, it is kept only briefly, and I do not use it to identify individual people. The legal basis is my legitimate interest in running the site securely and reliably (Article 6(1)(f) GDPR).
The message from the form is sent by my application through Cloudflare's e-mail service, from an address on the notify.patrykmoga.dev subdomain, and I receive it in the kontakt@patrykmoga.dev mailbox, which I run on Apple's iCloud Mail. Cloudflare and Apple are the only recipients of your data in this whole process. I pass it to nobody else, I do not sell it, and I do not use it for a newsletter, because I do not run one.
Cookies
I store no cookies of my own on your device and use no analytics tools, which is why you will not see a consent banner here. Cloudflare, as the operator of the infrastructure and of Turnstile, may store technical cookies or similar data in your browser, serving solely the security of the connection and the separation of automated traffic from human traffic.
Under Article 399 of the Polish Electronic Communications Law of 12 July 2024, storing information necessary to provide the service you yourself requested does not require your consent, but it does require informing you about it in an understandable way, which is what this paragraph does.
Transfers outside the EEA
Cloudflare and Apple are US companies, so some of the data may be processed outside the European Economic Area. Cloudflare is certified under the EU-US Data Privacy Framework, so the transfer rests on the European Commission's adequacy decision. Apple bases it on standard contractual clauses approved by the Commission. You can obtain information about these safeguards, and a copy of them, by writing to me at the address given above.
Your rights
In connection with this processing you have the right to:
- access your data and receive a copy of it,
- have inaccurate or incomplete data corrected,
- have your data erased and its processing restricted,
- receive the data you sent through the form in a portable form,
- object to processing based on my legitimate interest.
Writing to kontakt@patrykmoga.dev is enough, and I reply within a month at the latest; for exceptionally complex requests that period may be extended by a further two months, and I will let you know beforehand. If you believe I process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
Voluntariness and automated decisions
Providing your data is voluntary, but without an e-mail address and a message I cannot answer your inquiry. I make no decisions about you by automated means alone and I do not profile visitors. The Turnstile assessment applies to a single form submission and creates no profile and no history of your visits.
External links and changes to this policy
The site links to my clients' websites. Once you open them, their rules apply, not mine. I update this policy whenever what actually happens to the data changes, and the date of the last change is at the top of the document.